14.6
0-day
58 个模型检测该样本为恶意！
重新分析
更多

dcc39ce58dfbb4a76b2cc553cd796cb23f0c6b18ec44a3eeef7303d470002139

76aabc4357230893d7c0171d7a088831.exe

分析耗时

110s

最近分析

文件大小

1.3MB
静态报毒 动态报毒 100% AI SCORE=83 AIDETECTVM ANDROM AUTOG AVSARHER BTOMTW CONFIDENCE DELF DELPHILESS ELXR EMHC FAREIT GENERICKDZ HIGH CONFIDENCE HKXFKZ KRYPT KRYPTIK MALWARE2 MALWARE@#34AVR74FNY6MU NNDTU S + TROJ SAAB SCORE SIGGEN9 SUSGEN TH0@AWGR95GI TRJGEN TSCOPE UNSAFE UXVZSWOT3TR WACATAC X2066 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
CrowdStrike win/malicious_confidence_80% (W) 20190702 1.0
Alibaba Backdoor:Win32/Androm.d9f2be8e 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Tencent 20201228 1.0.0.1
Kingsoft 20201228 2017.9.26.565
McAfee Fareit-FTB!76AABC435723 20201228 6.0.6.653
Avast Win32:Trojan-gen 20201228 21.1.5827.0
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1619677954.829375
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (2 个事件)
Time & API Arguments Status Return Repeated
1619677929.45475
IsDebuggerPresent
failed 0 0
1619677959.45475
IsDebuggerPresent
failed 0 0
Command line console output was observed (1 个事件)
Time & API Arguments Status Return Repeated
1619677955.736375
WriteConsoleW
buffer: 成功: 成功创建计划任务 "Updates\GSECCr"。
console_handle: 0x00000007
success 1 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619677939.03375
GlobalMemoryStatusEx
success 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (23 个事件)
Time & API Arguments Status Return Repeated
1619677921.814625
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 36765504
registers.edi: 0
registers.eax: 0
registers.ebp: 36765576
registers.edx: 0
registers.ebx: 1983206444
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 32 6f 00 00 e9
exception.symbol: 76aabc4357230893d7c0171d7a088831+0x60259
exception.instruction: div eax
exception.module: 76aabc4357230893d7c0171d7a088831.exe
exception.exception_code: 0xc0000094
exception.offset: 393817
exception.address: 0x460259
success 0 0
1619677925.20525
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34668352
registers.edi: 0
registers.eax: 0
registers.ebp: 34668424
registers.edx: 0
registers.ebx: 1983206444
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 32 6f 00 00 e9
exception.symbol: web+0x60259
exception.instruction: div eax
exception.module: web.exe
exception.exception_code: 0xc0000094
exception.offset: 393817
exception.address: 0x460259
success 0 0
1619677929.986625
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
web+0x5a3f8 @ 0x45a3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x750d4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x750d5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff5d147d
success 0 0
1619677931.37725
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 51117888
registers.edi: 0
registers.eax: 0
registers.ebp: 51117960
registers.edx: 0
registers.ebx: 1983206444
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 32 6f 00 00 e9
exception.symbol: web+0x60259
exception.instruction: div eax
exception.module: web.exe
exception.exception_code: 0xc0000094
exception.offset: 393817
exception.address: 0x460259
success 0 0
1619677938.158875
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 35979072
registers.edi: 0
registers.eax: 0
registers.ebp: 35979144
registers.edx: 0
registers.ebx: 1983206444
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 32 6f 00 00 e9
exception.symbol: web+0x60259
exception.instruction: div eax
exception.module: web.exe
exception.exception_code: 0xc0000094
exception.offset: 393817
exception.address: 0x460259
success 0 0
1619677943.845875
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
web+0x5a3f8 @ 0x45a3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x750d4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x750d5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff41147d
success 0 0
1619677944.579875
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 50069312
registers.edi: 0
registers.eax: 0
registers.ebp: 50069384
registers.edx: 0
registers.ebx: 1983206444
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 32 6f 00 00 e9
exception.symbol: web+0x60259
exception.instruction: div eax
exception.module: web.exe
exception.exception_code: 0xc0000094
exception.offset: 393817
exception.address: 0x460259
success 0 0
1619677960.329875
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49872704
registers.edi: 0
registers.eax: 0
registers.ebp: 49872776
registers.edx: 0
registers.ebx: 1983206444
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 32 6f 00 00 e9
exception.symbol: web+0x60259
exception.instruction: div eax
exception.module: web.exe
exception.exception_code: 0xc0000094
exception.offset: 393817
exception.address: 0x460259
success 0 0
1619677964.01775
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
web+0x5a3f8 @ 0x45a3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x750d4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x750d5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff48147d
success 0 0
1619677965.954502
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49151808
registers.edi: 0
registers.eax: 0
registers.ebp: 49151880
registers.edx: 0
registers.ebx: 1983206444
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 32 6f 00 00 e9
exception.symbol: web+0x60259
exception.instruction: div eax
exception.module: web.exe
exception.exception_code: 0xc0000094
exception.offset: 393817
exception.address: 0x460259
success 0 0
1619677969.283502
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 50724672
registers.edi: 0
registers.eax: 0
registers.ebp: 50724744
registers.edx: 0
registers.ebx: 1983206444
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 32 6f 00 00 e9
exception.symbol: web+0x60259
exception.instruction: div eax
exception.module: web.exe
exception.exception_code: 0xc0000094
exception.offset: 393817
exception.address: 0x460259
success 0 0
1619677973.159125
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
web+0x5a3f8 @ 0x45a3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x750d4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x750d5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff43147d
success 0 0
1619677973.64275
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 50200384
registers.edi: 0
registers.eax: 0
registers.ebp: 50200456
registers.edx: 0
registers.ebx: 1983206444
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 32 6f 00 00 e9
exception.symbol: web+0x60259
exception.instruction: div eax
exception.module: web.exe
exception.exception_code: 0xc0000094
exception.offset: 393817
exception.address: 0x460259
success 0 0
1619677979.018125
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 50069312
registers.edi: 0
registers.eax: 0
registers.ebp: 50069384
registers.edx: 0
registers.ebx: 1983206444
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 32 6f 00 00 e9
exception.symbol: web+0x60259
exception.instruction: div eax
exception.module: web.exe
exception.exception_code: 0xc0000094
exception.offset: 393817
exception.address: 0x460259
success 0 0
1619677982.626625
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
web+0x5a3f8 @ 0x45a3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x750d4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x750d5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfd91147d
success 0 0
1619677982.65925
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 50331456
registers.edi: 0
registers.eax: 0
registers.ebp: 50331528
registers.edx: 0
registers.ebx: 1983206444
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 32 6f 00 00 e9
exception.symbol: web+0x60259
exception.instruction: div eax
exception.module: web.exe
exception.exception_code: 0xc0000094
exception.offset: 393817
exception.address: 0x460259
success 0 0
1619677987.283625
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 50069312
registers.edi: 0
registers.eax: 0
registers.ebp: 50069384
registers.edx: 0
registers.ebx: 1983206444
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 32 6f 00 00 e9
exception.symbol: web+0x60259
exception.instruction: div eax
exception.module: web.exe
exception.exception_code: 0xc0000094
exception.offset: 393817
exception.address: 0x460259
success 0 0
1619677991.112
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
web+0x5a3f8 @ 0x45a3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x750d4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x750d5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff46147d
success 0 0
1619677990.939625
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49413952
registers.edi: 0
registers.eax: 0
registers.ebp: 49414024
registers.edx: 0
registers.ebx: 1983206444
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 32 6f 00 00 e9
exception.symbol: web+0x60259
exception.instruction: div eax
exception.module: web.exe
exception.exception_code: 0xc0000094
exception.offset: 393817
exception.address: 0x460259
success 0 0
1619677996.095625
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49610560
registers.edi: 0
registers.eax: 0
registers.ebp: 49610632
registers.edx: 0
registers.ebx: 1983206444
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 32 6f 00 00 e9
exception.symbol: web+0x60259
exception.instruction: div eax
exception.module: web.exe
exception.exception_code: 0xc0000094
exception.offset: 393817
exception.address: 0x460259
success 0 0
1619678001.87725
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
web+0x5a3f8 @ 0x45a3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x750d4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x750d5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff28147d
success 0 0
1619678002.454875
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34799424
registers.edi: 0
registers.eax: 0
registers.ebp: 34799496
registers.edx: 0
registers.ebx: 1983206444
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 32 6f 00 00 e9
exception.symbol: web+0x60259
exception.instruction: div eax
exception.module: web.exe
exception.exception_code: 0xc0000094
exception.offset: 393817
exception.address: 0x460259
success 0 0
1619678010.95475
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 35127104
registers.edi: 0
registers.eax: 0
registers.ebp: 35127176
registers.edx: 0
registers.ebx: 1983206444
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 32 6f 00 00 e9
exception.symbol: web+0x60259
exception.instruction: div eax
exception.module: web.exe
exception.exception_code: 0xc0000094
exception.offset: 393817
exception.address: 0x460259
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (50 out of 275 个事件)
Time & API Arguments Status Return Repeated
1619677921.736625
NtAllocateVirtualMemory
process_identifier: 2440
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003d0000
success 0 0
1619677921.814625
NtProtectVirtualMemory
process_identifier: 2440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 28672
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00460000
success 0 0
1619677921.829625
NtAllocateVirtualMemory
process_identifier: 2440
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x005f0000
success 0 0
1619677925.15925
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619677925.20525
NtProtectVirtualMemory
process_identifier: 1380
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 28672
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00460000
success 0 0
1619677925.22125
NtAllocateVirtualMemory
process_identifier: 1380
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02ec0000
success 0 0
1619677928.56475
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 786432
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00420000
success 0 0
1619677928.56475
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004a0000
success 0 0
1619677929.22075
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73f31000
success 0 0
1619677929.47075
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0047a000
success 0 0
1619677929.47075
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73f32000
success 0 0
1619677929.47075
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00472000
success 0 0
1619677929.68975
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00482000
success 0 0
1619677931.61175
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00483000
success 0 0
1619677931.70475
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004fb000
success 0 0
1619677931.70475
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004f7000
success 0 0
1619677932.06475
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0048c000
success 0 0
1619677932.17375
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00780000
success 0 0
1619677932.73675
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00781000
success 0 0
1619677932.81475
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0048a000
success 0 0
1619677932.98675
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 344064
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00862000
success 0 0
1619677948.73675
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00484000
success 0 0
1619677948.76775
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00782000
success 0 0
1619677949.01775
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00783000
success 0 0
1619677949.12675
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00784000
success 0 0
1619677949.40875
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00785000
success 0 0
1619677949.43975
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00786000
success 0 0
1619677950.14275
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00485000
success 0 0
1619677950.14275
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00787000
success 0 0
1619677950.17375
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0078a000
success 0 0
1619677950.22075
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004ea000
success 0 0
1619677950.25175
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004e2000
success 0 0
1619677950.34575
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004f5000
success 0 0
1619677950.61175
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0078b000
success 0 0
1619677950.87675
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00496000
success 0 0
1619677950.89275
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0049a000
success 0 0
1619677950.89275
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00497000
success 0 0
1619677951.11175
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0047b000
success 0 0
1619677951.18975
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0078c000
success 0 0
1619677951.26775
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00486000
success 0 0
1619677951.48675
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 1572864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x07120000
success 0 0
1619677951.48675
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x07260000
success 0 0
1619677951.48675
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x07261000
success 0 0
1619677951.54875
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x07262000
success 0 0
1619677951.56475
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x07263000
success 0 0
1619677951.56475
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x07264000
success 0 0
1619677951.56475
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x07266000
success 0 0
1619677951.56475
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00487000
success 0 0
1619677951.61175
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0078d000
success 0 0
1619677951.64275
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x07269000
success 0 0
Creates executable files on the filesystem (2 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\iSjc3t29EfjInqO.exe
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\web.exe.vbs
Creates a suspicious process (2 个事件)
cmdline schtasks.exe /Create /TN "Updates\GSECCr" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpD23F.tmp"
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GSECCr" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpD23F.tmp"
Drops a binary and executes it (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\iSjc3t29EfjInqO.exe
Drops an executable to the user AppData folder (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\iSjc3t29EfjInqO.exe
A process created a hidden window (1 个事件)
Time & API Arguments Status Return Repeated
1619677954.28375
ShellExecuteExW
parameters: /Create /TN "Updates\GSECCr" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpD23F.tmp"
filepath: schtasks.exe
filepath_r: schtasks.exe
show_type: 0
success 1 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (13 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.317867051227938 section {'size_of_data': '0x000dca00', 'virtual_address': '0x00077000', 'entropy': 7.317867051227938, 'name': '.rsrc', 'virtual_size': '0x000dc938'} description A section with a high entropy has been found
entropy 0.6612963656800299 description Overall entropy of this PE file is high
Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)
Time & API Arguments Status Return Repeated
1619677932.95475
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
Expresses interest in specific running processes (1 个事件)
process web.exe
Repeatedly searches for a not-found process, you may want to run a web browser during analysis (22 个事件)
Time & API Arguments Status Return Repeated
1619677921.845625
Process32NextW
process_name: 76aabc4357230893d7c0171d7a088831.exe
snapshot_handle: 0x000000f8
process_identifier: 2440
failed 0 0
1619677925.23725
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 2996
failed 0 0
1619677935.39325
Process32NextW
process_name: web.exe
snapshot_handle: 0x00000144
process_identifier: 2864
failed 0 0
1619677938.517875
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 1868
failed 0 0
1619677944.611875
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 2940
failed 0 0
1619677958.767875
Process32NextW
process_name: dllhost.exe
snapshot_handle: 0x0000024c
process_identifier: 3140
failed 0 0
1619677960.361875
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3264
failed 0 0
1619677966.017502
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3468
failed 0 0
1619677967.079502
Process32NextW
process_name: web.exe
snapshot_handle: 0x00000114
process_identifier: 3376
failed 0 0
1619677969.908502
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3552
failed 0 0
1619677973.70475
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3720
failed 0 0
1619677978.23675
Process32NextW
process_name: web.exe
snapshot_handle: 0x0000015c
process_identifier: 3624
failed 0 0
1619677979.065125
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3796
failed 0 0
1619677982.69025
Process32NextW
process_name: is32bit.exe
snapshot_handle: 0x000000f8
process_identifier: 3972
failed 0 0
1619677986.45525
Process32NextW
process_name: is32bit.exe
snapshot_handle: 0x00000148
process_identifier: 4080
failed 0 0
1619677987.392625
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3164
failed 0 0
1619677991.126625
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3480
failed 0 0
1619677994.970625
Process32NextW
process_name: web.exe
snapshot_handle: 0x00000138
process_identifier: 2116
failed 0 0
1619677996.126625
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3484
failed 0 0
1619678002.517875
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 1072
failed 0 0
1619678009.329875
Process32NextW
process_name: web.exe
snapshot_handle: 0x00000170
process_identifier: 2824
failed 0 0
1619678010.98675
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 4060
failed 0 0
Uses Windows utilities for basic Windows functionality (2 个事件)
cmdline schtasks.exe /Create /TN "Updates\GSECCr" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpD23F.tmp"
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GSECCr" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpD23F.tmp"
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Creates an Alternate Data Stream (ADS) (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\startup\web.exe:ZoneIdentifier
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619677924.142625
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000100
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
Installs itself for autorun at Windows startup (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\web.exe.vbs
Creates a thread using NtQueueApcThread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2440 created a thread in remote process 732
Time & API Arguments Status Return Repeated
1619677924.142625
NtQueueApcThread
thread_handle: 0x00000108
process_identifier: 732
function_address: 0x000b05c0
parameter: 0x000c0000
success 0 0
Potential code injection by writing to the memory of another process (2 个事件)
Time & API Arguments Status Return Repeated
1619677924.142625
WriteProcessMemory
process_identifier: 732
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000100
base_address: 0x000b0000
success 1 0
1619677924.142625
WriteProcessMemory
process_identifier: 732
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\76aabc4357230893d7c0171d7a088831.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\startup\web.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\76aabc4357230893d7c0171d7a088831.exe" web.exeSET lbemLSSWviFlRr = createobJECt("wscript.shell") LbEmLssWvIFlRR.RuN """%ls""", 0, False
process_handle: 0x00000100
base_address: 0x000c0000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (14 个事件)
Process injection Process 1380 called NtSetContextThread to modify thread in remote process 2560
Process injection Process 1404 called NtSetContextThread to modify thread in remote process 3060
Process injection Process 3180 called NtSetContextThread to modify thread in remote process 3312
Process injection Process 3488 called NtSetContextThread to modify thread in remote process 3564
Process injection Process 3740 called NtSetContextThread to modify thread in remote process 3812
Process injection Process 3116 called NtSetContextThread to modify thread in remote process 3408
Process injection Process 3644 called NtSetContextThread to modify thread in remote process 3664
Time & API Arguments Status Return Repeated
1619677928.56525
NtSetContextThread
thread_handle: 0x00000230
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4912704
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2560
success 0 0
1619677942.845875
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4912704
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3060
success 0 0
1619677963.048875
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4912704
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3312
success 0 0
1619677972.423502
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4912704
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3564
success 0 0
1619677981.768125
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4912704
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3812
success 0 0
1619677989.767625
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4912704
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3408
success 0 0
1619678000.142625
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4912704
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3664
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (14 个事件)
Process injection Process 1380 resumed a thread in remote process 2560
Process injection Process 1404 resumed a thread in remote process 3060
Process injection Process 3180 resumed a thread in remote process 3312
Process injection Process 3488 resumed a thread in remote process 3564
Process injection Process 3740 resumed a thread in remote process 3812
Process injection Process 3116 resumed a thread in remote process 3408
Process injection Process 3644 resumed a thread in remote process 3664
Time & API Arguments Status Return Repeated
1619677929.03425
NtResumeThread
thread_handle: 0x00000230
suspend_count: 1
process_identifier: 2560
success 0 0
1619677943.345875
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3060
success 0 0
1619677963.658875
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3312
success 0 0
1619677972.783502
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3564
success 0 0
1619677982.205125
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3812
success 0 0
1619677990.189625
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3408
success 0 0
1619678001.220625
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3664
success 0 0
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 216.58.200.238:443
Executed a process and injected code into it, probably while unpacking (50 out of 67 个事件)
Time & API Arguments Status Return Repeated
1619677924.142625
CreateProcessInternalW
thread_identifier: 912
thread_handle: 0x00000108
process_identifier: 732
current_directory:
filepath: C:\Windows\System32\notepad.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\notepad.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619677924.142625
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000100
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
1619677924.142625
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
process_handle: 0x00000100
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000c0000
success 0 0
1619677924.142625
WriteProcessMemory
process_identifier: 732
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000100
base_address: 0x000b0000
success 1 0
1619677924.142625
WriteProcessMemory
process_identifier: 732
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\76aabc4357230893d7c0171d7a088831.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\startup\web.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\76aabc4357230893d7c0171d7a088831.exe" web.exeSET lbemLSSWviFlRr = createobJECt("wscript.shell") LbEmLssWvIFlRR.RuN """%ls""", 0, False
process_handle: 0x00000100
base_address: 0x000c0000
success 1 0
1619677924.87675
CreateProcessInternalW
thread_identifier: 1464
thread_handle: 0x000000d0
process_identifier: 1380
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\startup\web.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\startup\web.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000000cc
inherit_handles: 0
success 1 0
1619677928.15925
CreateProcessInternalW
thread_identifier: 2236
thread_handle: 0x0000025c
process_identifier: 2856
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\iSjc3t29EfjInqO.exe
track: 1
command_line: "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\iSjc3t29EfjInqO.exe"
filepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\iSjc3t29EfjInqO.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x00000254
inherit_handles: 0
success 1 0
1619677928.51825
CreateProcessInternalW
thread_identifier: 2120
thread_handle: 0x00000230
process_identifier: 2560
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\startup\web.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000224
inherit_handles: 0
success 1 0
1619677928.51825
NtUnmapViewOfSection
process_identifier: 2560
region_size: 4096
process_handle: 0x00000224
base_address: 0x00400000
success 0 0
1619677928.51825
NtMapViewOfSection
section_handle: 0x000001c0
process_identifier: 2560
commit_size: 724992
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000224
allocation_type: 0 ()
section_offset: 0
view_size: 724992
base_address: 0x00400000
success 0 0
1619677928.56525
NtGetContextThread
thread_handle: 0x00000230
success 0 0
1619677928.56525
NtSetContextThread
thread_handle: 0x00000230
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4912704
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2560
success 0 0
1619677929.03425
NtResumeThread
thread_handle: 0x00000230
suspend_count: 1
process_identifier: 2560
success 0 0
1619677929.28425
CreateProcessInternalW
thread_identifier: 2852
thread_handle: 0x000001c4
process_identifier: 2864
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\startup\web.exe" 2 2560 10894750
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000001b4
inherit_handles: 0
success 1 0
1619677929.45475
NtResumeThread
thread_handle: 0x000000d0
suspend_count: 1
process_identifier: 2856
success 0 0
1619677929.48675
NtResumeThread
thread_handle: 0x00000158
suspend_count: 1
process_identifier: 2856
success 0 0
1619677954.28375
CreateProcessInternalW
thread_identifier: 2448
thread_handle: 0x00003f60
process_identifier: 2840
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GSECCr" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpD23F.tmp"
filepath_r: C:\Windows\System32\schtasks.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x0000d7fc
inherit_handles: 0
success 1 0
1619677959.84575
CreateProcessInternalW
thread_identifier: 3216
thread_handle: 0x0000b634
process_identifier: 3212
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
track: 1
command_line: dw20.exe -x -s 53620
filepath_r: C:\Windows\Microsoft.NET\Framework\v2.0.50727\\dw20.exe
stack_pivoted: 0
creation_flags: 0 ()
process_handle: 0x0000a6c0
inherit_handles: 1
success 1 0
1619677936.94025
CreateProcessInternalW
thread_identifier: 1948
thread_handle: 0x00000148
process_identifier: 1404
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\startup\web.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\startup\web.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000014c
inherit_handles: 0
success 1 0
1619677942.814875
CreateProcessInternalW
thread_identifier: 2144
thread_handle: 0x00000108
process_identifier: 3060
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\startup\web.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619677942.814875
NtUnmapViewOfSection
process_identifier: 3060
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619677942.814875
NtMapViewOfSection
section_handle: 0x00000110
process_identifier: 3060
commit_size: 724992
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 724992
base_address: 0x00400000
success 0 0
1619677942.845875
NtGetContextThread
thread_handle: 0x00000108
success 0 0
1619677942.845875
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4912704
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3060
success 0 0
1619677943.345875
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3060
success 0 0
1619677943.845875
CreateProcessInternalW
thread_identifier: 912
thread_handle: 0x0000010c
process_identifier: 1464
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\startup\web.exe" 2 3060 10909078
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000011c
inherit_handles: 0
success 1 0
1619677959.642875
CreateProcessInternalW
thread_identifier: 3184
thread_handle: 0x00000250
process_identifier: 3180
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\startup\web.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\startup\web.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000254
inherit_handles: 0
success 1 0
1619677963.017875
CreateProcessInternalW
thread_identifier: 3316
thread_handle: 0x00000108
process_identifier: 3312
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\startup\web.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619677963.017875
NtUnmapViewOfSection
process_identifier: 3312
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619677963.017875
NtMapViewOfSection
section_handle: 0x00000110
process_identifier: 3312
commit_size: 724992
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 724992
base_address: 0x00400000
success 0 0
1619677963.048875
NtGetContextThread
thread_handle: 0x00000108
success 0 0
1619677963.048875
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4912704
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3312
success 0 0
1619677963.658875
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3312
success 0 0
1619677963.986875
CreateProcessInternalW
thread_identifier: 3380
thread_handle: 0x0000010c
process_identifier: 3376
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\startup\web.exe" 2 3312 10929375
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000011c
inherit_handles: 0
success 1 0
1619677968.454502
CreateProcessInternalW
thread_identifier: 3492
thread_handle: 0x00000118
process_identifier: 3488
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\startup\web.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\startup\web.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000011c
inherit_handles: 0
success 1 0
1619677972.361502
CreateProcessInternalW
thread_identifier: 3568
thread_handle: 0x00000108
process_identifier: 3564
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\startup\web.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619677972.361502
NtUnmapViewOfSection
process_identifier: 3564
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619677972.376502
NtMapViewOfSection
section_handle: 0x00000110
process_identifier: 3564
commit_size: 724992
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 724992
base_address: 0x00400000
success 0 0
1619677972.423502
NtGetContextThread
thread_handle: 0x00000108
success 0 0
1619677972.423502
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4912704
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3564
success 0 0
1619677972.783502
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3564
success 0 0
1619677972.923502
CreateProcessInternalW
thread_identifier: 3628
thread_handle: 0x0000010c
process_identifier: 3624
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\startup\web.exe" 2 3564 10938500
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000011c
inherit_handles: 0
success 1 0
1619677978.48675
CreateProcessInternalW
thread_identifier: 3744
thread_handle: 0x00000160
process_identifier: 3740
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\startup\web.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\startup\web.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000164
inherit_handles: 0
success 1 0
1619677981.705125
CreateProcessInternalW
thread_identifier: 3816
thread_handle: 0x00000108
process_identifier: 3812
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\startup\web.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619677981.705125
NtUnmapViewOfSection
process_identifier: 3812
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619677981.705125
NtMapViewOfSection
section_handle: 0x00000110
process_identifier: 3812
commit_size: 724992
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 724992
base_address: 0x00400000
success 0 0
1619677981.752125
NtGetContextThread
thread_handle: 0x00000108
success 0 0
1619677981.768125
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4912704
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3812
success 0 0
1619677982.205125
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3812
success 0 0
1619677982.299125
CreateProcessInternalW
thread_identifier: 3900
thread_handle: 0x0000010c
process_identifier: 3896
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\startup\web.exe" 2 3812 10947921
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000011c
inherit_handles: 0
success 1 0
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x46b13c VirtualFree
• 0x46b140 VirtualAlloc
• 0x46b144 LocalFree
• 0x46b148 LocalAlloc
• 0x46b14c GetVersion
• 0x46b150 GetCurrentThreadId
• 0x46b15c VirtualQuery
• 0x46b160 WideCharToMultiByte
• 0x46b168 MultiByteToWideChar
• 0x46b16c lstrlenA
• 0x46b170 lstrcpynA
• 0x46b174 LoadLibraryExA
• 0x46b178 GetThreadLocale
• 0x46b17c GetStartupInfoA
• 0x46b180 GetProcAddress
• 0x46b184 GetModuleHandleA
• 0x46b188 GetModuleFileNameA
• 0x46b18c GetLocaleInfoA
• 0x46b190 GetLastError
• 0x46b198 GetCommandLineA
• 0x46b19c FreeLibrary
• 0x46b1a0 FindFirstFileA
• 0x46b1a4 FindClose
• 0x46b1a8 ExitProcess
• 0x46b1ac WriteFile
• 0x46b1b4 RtlUnwind
• 0x46b1b8 RaiseException
• 0x46b1bc GetStdHandle
Library user32.dll:
• 0x46b1c4 GetKeyboardType
• 0x46b1c8 LoadStringA
• 0x46b1cc MessageBoxA
• 0x46b1d0 CharNextA
Library advapi32.dll:
• 0x46b1d8 RegQueryValueExA
• 0x46b1dc RegOpenKeyExA
• 0x46b1e0 RegCloseKey
Library oleaut32.dll:
• 0x46b1e8 SysFreeString
• 0x46b1ec SysReAllocStringLen
• 0x46b1f0 SysAllocStringLen
Library kernel32.dll:
• 0x46b1f8 TlsSetValue
• 0x46b1fc TlsGetValue
• 0x46b200 LocalAlloc
• 0x46b204 GetModuleHandleA
Library advapi32.dll:
• 0x46b20c RegQueryValueExA
• 0x46b210 RegOpenKeyExA
• 0x46b214 RegCloseKey
Library kernel32.dll:
• 0x46b21c lstrcpyA
• 0x46b220 WriteFile
• 0x46b228 WaitForSingleObject
• 0x46b22c VirtualQuery
• 0x46b230 VirtualAlloc
• 0x46b234 Sleep
• 0x46b238 SizeofResource
• 0x46b23c SetThreadLocale
• 0x46b240 SetFilePointer
• 0x46b244 SetEvent
• 0x46b248 SetErrorMode
• 0x46b24c SetEndOfFile
• 0x46b250 ResetEvent
• 0x46b254 ReadFile
• 0x46b258 MulDiv
• 0x46b25c LockResource
• 0x46b260 LoadResource
• 0x46b264 LoadLibraryA
• 0x46b270 GlobalUnlock
• 0x46b274 GlobalReAlloc
• 0x46b278 GlobalHandle
• 0x46b27c GlobalLock
• 0x46b280 GlobalFree
• 0x46b284 GlobalFindAtomA
• 0x46b288 GlobalDeleteAtom
• 0x46b28c GlobalAlloc
• 0x46b290 GlobalAddAtomA
• 0x46b294 GetVersionExA
• 0x46b298 GetVersion
• 0x46b29c GetTickCount
• 0x46b2a0 GetThreadLocale
• 0x46b2a8 GetSystemTime
• 0x46b2ac GetSystemInfo
• 0x46b2b0 GetStringTypeExA
• 0x46b2b4 GetStdHandle
• 0x46b2b8 GetProcAddress
• 0x46b2bc GetModuleHandleA
• 0x46b2c0 GetModuleFileNameA
• 0x46b2c4 GetLocaleInfoA
• 0x46b2c8 GetLocalTime
• 0x46b2cc GetLastError
• 0x46b2d0 GetFullPathNameA
• 0x46b2d4 GetFileAttributesA
• 0x46b2d8 GetDiskFreeSpaceA
• 0x46b2dc GetDateFormatA
• 0x46b2e0 GetCurrentThreadId
• 0x46b2e4 GetCurrentProcessId
• 0x46b2e8 GetCPInfo
• 0x46b2ec GetACP
• 0x46b2f0 FreeResource
• 0x46b2f4 InterlockedExchange
• 0x46b2f8 FreeLibrary
• 0x46b2fc FormatMessageA
• 0x46b300 FindResourceA
• 0x46b304 FindNextFileA
• 0x46b308 FindFirstFileA
• 0x46b30c FindClose
• 0x46b318 ExitThread
• 0x46b31c EnumCalendarInfoA
• 0x46b328 CreateThread
• 0x46b32c CreateFileA
• 0x46b330 CreateEventA
• 0x46b334 CompareStringA
• 0x46b338 CloseHandle
Library version.dll:
• 0x46b340 VerQueryValueA
• 0x46b348 GetFileVersionInfoA
Library gdi32.dll:
• 0x46b350 UnrealizeObject
• 0x46b354 StretchBlt
• 0x46b358 SetWindowOrgEx
• 0x46b35c SetWinMetaFileBits
• 0x46b360 SetViewportOrgEx
• 0x46b364 SetTextColor
• 0x46b368 SetStretchBltMode
• 0x46b36c SetROP2
• 0x46b370 SetPixel
• 0x46b374 SetEnhMetaFileBits
• 0x46b378 SetDIBColorTable
• 0x46b37c SetBrushOrgEx
• 0x46b380 SetBkMode
• 0x46b384 SetBkColor
• 0x46b388 SelectPalette
• 0x46b38c SelectObject
• 0x46b390 SelectClipPath
• 0x46b394 SaveDC
• 0x46b398 RestoreDC
• 0x46b39c Rectangle
• 0x46b3a0 RectVisible
• 0x46b3a4 RealizePalette
• 0x46b3a8 Polyline
• 0x46b3ac PlayEnhMetaFile
• 0x46b3b0 PatBlt
• 0x46b3b4 MoveToEx
• 0x46b3b8 MaskBlt
• 0x46b3bc LineTo
• 0x46b3c0 IntersectClipRect
• 0x46b3c4 GetWindowOrgEx
• 0x46b3c8 GetWinMetaFileBits
• 0x46b3cc GetTextMetricsA
• 0x46b3d8 GetStockObject
• 0x46b3dc GetPixel
• 0x46b3e0 GetPaletteEntries
• 0x46b3e4 GetObjectA
• 0x46b3f0 GetEnhMetaFileBits
• 0x46b3f4 GetDeviceCaps
• 0x46b3f8 GetDIBits
• 0x46b3fc GetDIBColorTable
• 0x46b400 GetDCOrgEx
• 0x46b408 GetClipBox
• 0x46b40c GetBrushOrgEx
• 0x46b410 GetBitmapBits
• 0x46b414 ExtTextOutA
• 0x46b418 ExcludeClipRect
• 0x46b41c DeleteObject
• 0x46b420 DeleteEnhMetaFile
• 0x46b424 DeleteDC
• 0x46b428 CreateSolidBrush
• 0x46b42c CreatePenIndirect
• 0x46b430 CreatePen
• 0x46b434 CreatePalette
• 0x46b43c CreateFontIndirectA
• 0x46b440 CreateDIBitmap
• 0x46b444 CreateDIBSection
• 0x46b448 CreateCompatibleDC
• 0x46b450 CreateBrushIndirect
• 0x46b454 CreateBitmap
• 0x46b458 CopyEnhMetaFileA
• 0x46b45c BitBlt
Library user32.dll:
• 0x46b464 CreateWindowExA
• 0x46b468 WindowFromPoint
• 0x46b46c WinHelpA
• 0x46b470 WaitMessage
• 0x46b474 ValidateRect
• 0x46b478 UpdateWindow
• 0x46b47c UnregisterClassA
• 0x46b480 UnhookWindowsHookEx
• 0x46b484 TranslateMessage
• 0x46b48c TrackPopupMenu
• 0x46b494 ShowWindow
• 0x46b498 ShowScrollBar
• 0x46b49c ShowOwnedPopups
• 0x46b4a0 ShowCursor
• 0x46b4a4 SetWindowsHookExA
• 0x46b4a8 SetWindowTextA
• 0x46b4ac SetWindowPos
• 0x46b4b0 SetWindowPlacement
• 0x46b4b4 SetWindowLongA
• 0x46b4b8 SetTimer
• 0x46b4bc SetScrollRange
• 0x46b4c0 SetScrollPos
• 0x46b4c4 SetScrollInfo
• 0x46b4c8 SetRect
• 0x46b4cc SetPropA
• 0x46b4d0 SetParent
• 0x46b4d4 SetMenuItemInfoA
• 0x46b4d8 SetMenu
• 0x46b4dc SetForegroundWindow
• 0x46b4e0 SetFocus
• 0x46b4e4 SetCursor
• 0x46b4e8 SetClassLongA
• 0x46b4ec SetCapture
• 0x46b4f0 SetActiveWindow
• 0x46b4f4 SendMessageA
• 0x46b4f8 ScrollWindow
• 0x46b4fc ScreenToClient
• 0x46b500 RemovePropA
• 0x46b504 RemoveMenu
• 0x46b508 ReleaseDC
• 0x46b50c ReleaseCapture
• 0x46b518 RegisterClassA
• 0x46b51c RedrawWindow
• 0x46b520 PtInRect
• 0x46b524 PostQuitMessage
• 0x46b528 PostMessageA
• 0x46b52c PeekMessageA
• 0x46b530 OffsetRect
• 0x46b534 OemToCharA
• 0x46b538 MessageBoxA
• 0x46b53c MapWindowPoints
• 0x46b540 MapVirtualKeyA
• 0x46b544 LoadStringA
• 0x46b548 LoadKeyboardLayoutA
• 0x46b54c LoadIconA
• 0x46b550 LoadCursorA
• 0x46b554 LoadBitmapA
• 0x46b558 KillTimer
• 0x46b55c IsZoomed
• 0x46b560 IsWindowVisible
• 0x46b564 IsWindowEnabled
• 0x46b568 IsWindow
• 0x46b56c IsRectEmpty
• 0x46b570 IsIconic
• 0x46b574 IsDialogMessageA
• 0x46b578 IsChild
• 0x46b57c InvalidateRect
• 0x46b580 IntersectRect
• 0x46b584 InsertMenuItemA
• 0x46b588 InsertMenuA
• 0x46b58c InflateRect
• 0x46b594 GetWindowTextA
• 0x46b598 GetWindowRect
• 0x46b59c GetWindowPlacement
• 0x46b5a0 GetWindowLongA
• 0x46b5a4 GetWindowDC
• 0x46b5a8 GetTopWindow
• 0x46b5ac GetSystemMetrics
• 0x46b5b0 GetSystemMenu
• 0x46b5b4 GetSysColorBrush
• 0x46b5b8 GetSysColor
• 0x46b5bc GetSubMenu
• 0x46b5c0 GetScrollRange
• 0x46b5c4 GetScrollPos
• 0x46b5c8 GetScrollInfo
• 0x46b5cc GetPropA
• 0x46b5d0 GetParent
• 0x46b5d4 GetWindow
• 0x46b5d8 GetMenuStringA
• 0x46b5dc GetMenuState
• 0x46b5e0 GetMenuItemInfoA
• 0x46b5e4 GetMenuItemID
• 0x46b5e8 GetMenuItemCount
• 0x46b5ec GetMenu
• 0x46b5f0 GetLastActivePopup
• 0x46b5f4 GetKeyboardState
• 0x46b5fc GetKeyboardLayout
• 0x46b600 GetKeyState
• 0x46b604 GetKeyNameTextA
• 0x46b608 GetIconInfo
• 0x46b60c GetForegroundWindow
• 0x46b610 GetFocus
• 0x46b614 GetDlgItem
• 0x46b618 GetDesktopWindow
• 0x46b61c GetDCEx
• 0x46b620 GetDC
• 0x46b624 GetCursorPos
• 0x46b628 GetCursor
• 0x46b62c GetClipboardData
• 0x46b630 GetClientRect
• 0x46b634 GetClassNameA
• 0x46b638 GetClassInfoA
• 0x46b63c GetCapture
• 0x46b640 GetActiveWindow
• 0x46b644 FrameRect
• 0x46b648 FindWindowA
• 0x46b64c FillRect
• 0x46b650 EqualRect
• 0x46b654 EnumWindows
• 0x46b658 EnumThreadWindows
• 0x46b65c EndPaint
• 0x46b660 EnableWindow
• 0x46b664 EnableScrollBar
• 0x46b668 EnableMenuItem
• 0x46b66c DrawTextA
• 0x46b670 DrawMenuBar
• 0x46b674 DrawIconEx
• 0x46b678 DrawIcon
• 0x46b67c DrawFrameControl
• 0x46b680 DrawFocusRect
• 0x46b684 DrawEdge
• 0x46b688 DispatchMessageA
• 0x46b68c DestroyWindow
• 0x46b690 DestroyMenu
• 0x46b694 DestroyIcon
• 0x46b698 DestroyCursor
• 0x46b69c DeleteMenu
• 0x46b6a0 DefWindowProcA
• 0x46b6a4 DefMDIChildProcA
• 0x46b6a8 DefFrameProcA
• 0x46b6ac CreatePopupMenu
• 0x46b6b0 CreateMenu
• 0x46b6b4 CreateIcon
• 0x46b6b8 ClientToScreen
• 0x46b6bc CheckMenuItem
• 0x46b6c0 CallWindowProcA
• 0x46b6c4 CallNextHookEx
• 0x46b6c8 BeginPaint
• 0x46b6cc CharNextA
• 0x46b6d0 CharLowerBuffA
• 0x46b6d4 CharLowerA
• 0x46b6d8 CharToOemA
• 0x46b6dc AdjustWindowRectEx
Library kernel32.dll:
• 0x46b6e8 Sleep
Library oleaut32.dll:
• 0x46b6f0 SafeArrayPtrOfIndex
• 0x46b6f4 SafeArrayGetUBound
• 0x46b6f8 SafeArrayGetLBound
• 0x46b6fc SafeArrayCreate
• 0x46b700 VariantChangeType
• 0x46b704 VariantCopy
• 0x46b708 VariantClear
• 0x46b70c VariantInit
Library comctl32.dll:
• 0x46b71c ImageList_Write
• 0x46b720 ImageList_Read
• 0x46b730 ImageList_DragMove
• 0x46b734 ImageList_DragLeave
• 0x46b738 ImageList_DragEnter
• 0x46b73c ImageList_EndDrag
• 0x46b740 ImageList_BeginDrag
• 0x46b744 ImageList_Remove
• 0x46b748 ImageList_DrawEx
• 0x46b74c ImageList_Replace
• 0x46b750 ImageList_Draw
• 0x46b760 ImageList_Add
• 0x46b768 ImageList_Destroy
• 0x46b76c ImageList_Create
• 0x46b770 InitCommonControls
Library comdlg32.dll:
• 0x46b778 GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 63430 239.255.255.250 3702
192.168.56.101 65005 239.255.255.250 3702
192.168.56.101 65007 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.